{
  "dataset": "Canopii MCP Security Index",
  "edition": "2026-11",
  "capturedAt": "2026-11-01T19:39:21.031Z",
  "source": "https://index.canopii.dev/mcp-security-index/2026-11",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "attribution": "Canopii Trust Index",
  "corpus": {
    "scored": 44242,
    "pending": 5,
    "servers": 56588,
    "liveProbed": 3095,
    "unverifiable": 12341
  },
  "grades": [
    {
      "n": 13891,
      "pct": 31,
      "grade": "A"
    },
    {
      "n": 14738,
      "pct": 33,
      "grade": "B"
    },
    {
      "n": 3060,
      "pct": 7,
      "grade": "C"
    },
    {
      "n": 9338,
      "pct": 21,
      "grade": "D"
    },
    {
      "n": 3215,
      "pct": 7,
      "grade": "F"
    }
  ],
  "controls": [
    {
      "id": "code.no_command_injection",
      "fail": 666,
      "pass": 34099,
      "warn": 323,
      "guard": true,
      "title": "No command-injection sinks",
      "domain": "code_safety",
      "weight": 10,
      "failPct": 2,
      "evaluated": 35088,
      "notChecked": 9154,
      "notApplicable": 0
    },
    {
      "id": "code.no_code_eval",
      "fail": 357,
      "pass": 34584,
      "warn": 147,
      "guard": true,
      "title": "No dynamic code execution",
      "domain": "code_safety",
      "weight": 8,
      "failPct": 1,
      "evaluated": 35088,
      "notChecked": 9154,
      "notApplicable": 0
    },
    {
      "id": "code.no_path_traversal",
      "fail": 0,
      "pass": 25759,
      "warn": 9329,
      "guard": true,
      "title": "No path traversal",
      "domain": "code_safety",
      "weight": 7,
      "failPct": 0,
      "evaluated": 35088,
      "notChecked": 9154,
      "notApplicable": 0
    },
    {
      "id": "code.no_ssrf",
      "fail": 0,
      "pass": 24070,
      "warn": 11018,
      "guard": true,
      "title": "No SSRF sinks",
      "domain": "code_safety",
      "weight": 6,
      "failPct": 0,
      "evaluated": 35088,
      "notChecked": 9154,
      "notApplicable": 0
    },
    {
      "id": "code.no_unsafe_deserialize",
      "fail": 97,
      "pass": 34966,
      "warn": 25,
      "guard": true,
      "title": "No unsafe deserialization",
      "domain": "code_safety",
      "weight": 6,
      "failPct": 0,
      "evaluated": 35088,
      "notChecked": 9154,
      "notApplicable": 0
    },
    {
      "id": "secrets.no_committed_secrets",
      "fail": 0,
      "pass": 35088,
      "warn": 0,
      "guard": true,
      "title": "No committed secrets",
      "domain": "secrets",
      "weight": 10,
      "failPct": 0,
      "evaluated": 35088,
      "notChecked": 9154,
      "notApplicable": 0
    },
    {
      "id": "secrets.from_env",
      "fail": 0,
      "pass": 22136,
      "warn": 12952,
      "guard": false,
      "title": "Credentials sourced from environment",
      "domain": "secrets",
      "weight": 3,
      "failPct": 0,
      "evaluated": 35088,
      "notChecked": 9154,
      "notApplicable": 0
    },
    {
      "id": "supply.no_known_vulns",
      "fail": 0,
      "pass": 18452,
      "warn": 5128,
      "guard": false,
      "title": "No known-vulnerable dependencies",
      "domain": "supply_chain",
      "weight": 9,
      "failPct": 0,
      "evaluated": 23580,
      "notChecked": 11523,
      "notApplicable": 9139
    },
    {
      "id": "supply.deps_pinned",
      "fail": 0,
      "pass": 8261,
      "warn": 26827,
      "guard": false,
      "title": "Dependencies pinned (lockfile)",
      "domain": "supply_chain",
      "weight": 5,
      "failPct": 0,
      "evaluated": 35088,
      "notChecked": 9154,
      "notApplicable": 0
    },
    {
      "id": "supply.no_install_scripts",
      "fail": 407,
      "pass": 13816,
      "warn": 0,
      "guard": true,
      "title": "No install/post-install scripts",
      "domain": "supply_chain",
      "weight": 5,
      "failPct": 3,
      "evaluated": 14223,
      "notChecked": 4443,
      "notApplicable": 25576
    },
    {
      "id": "supply.not_typosquatting",
      "fail": 13,
      "pass": 18601,
      "warn": 0,
      "guard": true,
      "title": "Package name not typosquatting",
      "domain": "supply_chain",
      "weight": 6,
      "failPct": 0,
      "evaluated": 18614,
      "notChecked": 52,
      "notApplicable": 25576
    },
    {
      "id": "supply.provenance",
      "fail": 0,
      "pass": 4894,
      "warn": 9329,
      "guard": false,
      "title": "Published with provenance",
      "domain": "supply_chain",
      "weight": 3,
      "failPct": 0,
      "evaluated": 14223,
      "notChecked": 4443,
      "notApplicable": 25576
    },
    {
      "id": "supply.maintainer_established",
      "fail": 0,
      "pass": 2850,
      "warn": 15764,
      "guard": false,
      "title": "Established maintainer",
      "domain": "supply_chain",
      "weight": 3,
      "failPct": 0,
      "evaluated": 18614,
      "notChecked": 52,
      "notApplicable": 25576
    },
    {
      "id": "tool.no_injection_markers",
      "fail": 2505,
      "pass": 32243,
      "warn": 0,
      "guard": true,
      "title": "Tool descriptions free of injection markers",
      "domain": "tool_integrity",
      "weight": 9,
      "failPct": 7,
      "evaluated": 34748,
      "notChecked": 9494,
      "notApplicable": 0
    },
    {
      "id": "tool.schemas_strict",
      "fail": 0,
      "pass": 3851,
      "warn": 22763,
      "guard": false,
      "title": "Strict tool input schemas",
      "domain": "tool_integrity",
      "weight": 4,
      "failPct": 0,
      "evaluated": 26614,
      "notChecked": 17628,
      "notApplicable": 0
    },
    {
      "id": "tool.no_rug_pull",
      "fail": 54,
      "pass": 9507,
      "warn": 4155,
      "guard": true,
      "title": "No risky post-publish tool changes (rug-pull)",
      "domain": "tool_integrity",
      "weight": 6,
      "failPct": 0,
      "evaluated": 13716,
      "notChecked": 0,
      "notApplicable": 30526
    },
    {
      "id": "tool.no_runtime_mutation",
      "fail": 1,
      "pass": 24368,
      "warn": 36,
      "guard": true,
      "title": "No in-session tool-definition changes",
      "domain": "tool_integrity",
      "weight": 5,
      "failPct": 0,
      "evaluated": 24405,
      "notChecked": 5573,
      "notApplicable": 0
    },
    {
      "id": "tool.no_destructive_scope",
      "fail": 2839,
      "pass": 31909,
      "warn": 0,
      "guard": true,
      "title": "No over-broad / destructive tools",
      "domain": "tool_integrity",
      "weight": 4,
      "failPct": 8,
      "evaluated": 34748,
      "notChecked": 9494,
      "notApplicable": 0
    },
    {
      "id": "transport.uses_tls",
      "fail": 0,
      "pass": 26012,
      "warn": 0,
      "guard": true,
      "title": "Remote endpoints use TLS",
      "domain": "auth_transport",
      "weight": 7,
      "failPct": 0,
      "evaluated": 26012,
      "notChecked": 0,
      "notApplicable": 18230
    },
    {
      "id": "auth.declared",
      "fail": 0,
      "pass": 2662,
      "warn": 23350,
      "guard": false,
      "title": "Authentication declared",
      "domain": "auth_transport",
      "weight": 5,
      "failPct": 0,
      "evaluated": 26012,
      "notChecked": 0,
      "notApplicable": 18230
    },
    {
      "id": "auth.no_token_passthrough",
      "fail": 110,
      "pass": 13060,
      "warn": 62,
      "guard": true,
      "title": "No token passthrough",
      "domain": "auth_transport",
      "weight": 6,
      "failPct": 1,
      "evaluated": 13232,
      "notChecked": 5573,
      "notApplicable": 11173
    },
    {
      "id": "transport.origin_validated",
      "fail": 125,
      "pass": 731,
      "warn": 2730,
      "guard": false,
      "title": "Origin validated (DNS-rebinding protection)",
      "domain": "auth_transport",
      "weight": 4,
      "failPct": 3,
      "evaluated": 3586,
      "notChecked": 15206,
      "notApplicable": 11186
    },
    {
      "id": "deploy.sandboxed",
      "fail": 0,
      "pass": 5951,
      "warn": 29137,
      "guard": false,
      "title": "Execution sandboxing",
      "domain": "auth_transport",
      "weight": 3,
      "failPct": 0,
      "evaluated": 35088,
      "notChecked": 9154,
      "notApplicable": 0
    },
    {
      "id": "dynamic.reachable",
      "fail": 0,
      "pass": 0,
      "warn": 0,
      "guard": false,
      "title": "Live endpoint reachable",
      "domain": "auth_transport",
      "weight": 3,
      "failPct": 0,
      "evaluated": 0,
      "notChecked": 0,
      "notApplicable": 44242
    },
    {
      "id": "dynamic.auth_enforced",
      "fail": 0,
      "pass": 0,
      "warn": 0,
      "guard": false,
      "title": "Authentication enforced",
      "domain": "auth_transport",
      "weight": 4,
      "failPct": 0,
      "evaluated": 0,
      "notChecked": 0,
      "notApplicable": 44242
    },
    {
      "id": "transport.no_bind_all",
      "fail": 0,
      "pass": 30728,
      "warn": 4360,
      "guard": false,
      "title": "No bind-all / exposed debug",
      "domain": "auth_transport",
      "weight": 3,
      "failPct": 0,
      "evaluated": 35088,
      "notChecked": 9154,
      "notApplicable": 0
    },
    {
      "id": "maint.actively_maintained",
      "fail": 0,
      "pass": 30923,
      "warn": 1716,
      "guard": false,
      "title": "Actively maintained",
      "domain": "maintenance",
      "weight": 4,
      "failPct": 0,
      "evaluated": 32639,
      "notChecked": 11603,
      "notApplicable": 0
    },
    {
      "id": "maint.not_archived",
      "fail": 364,
      "pass": 32275,
      "warn": 0,
      "guard": true,
      "title": "Repository not archived",
      "domain": "maintenance",
      "weight": 2,
      "failPct": 1,
      "evaluated": 32639,
      "notChecked": 11603,
      "notApplicable": 0
    },
    {
      "id": "gov.declares_license",
      "fail": 0,
      "pass": 24251,
      "warn": 8388,
      "guard": false,
      "title": "Declares a license",
      "domain": "maintenance",
      "weight": 3,
      "failPct": 0,
      "evaluated": 32639,
      "notChecked": 11603,
      "notApplicable": 0
    },
    {
      "id": "gov.security_policy",
      "fail": 0,
      "pass": 6471,
      "warn": 28617,
      "guard": false,
      "title": "Has a security policy",
      "domain": "maintenance",
      "weight": 2,
      "failPct": 0,
      "evaluated": 35088,
      "notChecked": 9154,
      "notApplicable": 0
    },
    {
      "id": "gov.signed_releases",
      "fail": 0,
      "pass": 0,
      "warn": 0,
      "guard": false,
      "title": "Signed releases",
      "domain": "maintenance",
      "weight": 2,
      "failPct": 0,
      "evaluated": 0,
      "notChecked": 44242,
      "notApplicable": 0
    },
    {
      "id": "reputation.adoption",
      "fail": 0,
      "pass": 14694,
      "warn": 20301,
      "guard": false,
      "title": "Adoption & popularity",
      "domain": "maintenance",
      "weight": 2,
      "failPct": 0,
      "evaluated": 34995,
      "notChecked": 9247,
      "notApplicable": 0
    }
  ],
  "headline": {
    "dfPct": 28,
    "noAuthPct": 53,
    "secretsPct": 0,
    "codeSafetyPct": 2,
    "authTheaterPct": 3,
    "toolPoisoningPct": 6
  },
  "confidence": [
    {
      "dfPct": 11,
      "label": "High (80%+ verified)",
      "servers": 29827,
      "avgScore": 81
    },
    {
      "dfPct": 3,
      "label": "60–80% verified",
      "servers": 5261,
      "avgScore": 78
    },
    {
      "dfPct": 100,
      "label": "Low (under 40% verified)",
      "servers": 9154,
      "avgScore": 40
    }
  ],
  "ecosystems": [
    {
      "dfPct": 40,
      "label": "repo / remote-only",
      "servers": 24669,
      "avgScore": 65
    },
    {
      "dfPct": 15,
      "label": "npm",
      "servers": 14226,
      "avgScore": 81
    },
    {
      "dfPct": 8,
      "label": "pypi",
      "servers": 4413,
      "avgScore": 81
    },
    {
      "dfPct": 4,
      "label": "mcpb",
      "servers": 702,
      "avgScore": 84
    },
    {
      "dfPct": 5,
      "label": "nuget",
      "servers": 140,
      "avgScore": 88
    },
    {
      "dfPct": 3,
      "label": "cargo",
      "servers": 92,
      "avgScore": 87
    }
  ],
  "generatedAt": "2026-11-01T19:39:21.031Z",
  "toolSurface": [
    {
      "dfPct": 4,
      "label": "No tools",
      "servers": 9494,
      "avgScore": 82
    },
    {
      "dfPct": 37,
      "label": "1–5 tools",
      "servers": 12723,
      "avgScore": 71
    },
    {
      "dfPct": 34,
      "label": "6–20 tools",
      "servers": 12808,
      "avgScore": 72
    },
    {
      "dfPct": 35,
      "label": "20+ tools",
      "servers": 9217,
      "avgScore": 63
    }
  ],
  "scoreSummary": {
    "max": 100,
    "min": 12,
    "p25": 40,
    "p75": 90,
    "mean": 71.9,
    "median": 85
  },
  "scoringVersion": "2.11.0",
  "popularityStars": [
    {
      "dfPct": 15,
      "label": "1,000+ stars",
      "servers": 353,
      "avgScore": 78
    },
    {
      "dfPct": 13,
      "label": "100–999 stars",
      "servers": 1341,
      "avgScore": 79
    },
    {
      "dfPct": 10,
      "label": "10–99 stars",
      "servers": 3126,
      "avgScore": 80
    },
    {
      "dfPct": 10,
      "label": "Under 10 stars",
      "servers": 27819,
      "avgScore": 80
    }
  ],
  "popularityDownloads": [
    {
      "dfPct": 10,
      "label": "100k+/month",
      "servers": 42,
      "avgScore": 83
    },
    {
      "dfPct": 12,
      "label": "10k–100k/month",
      "servers": 145,
      "avgScore": 79
    },
    {
      "dfPct": 7,
      "label": "1k–10k/month",
      "servers": 2111,
      "avgScore": 85
    },
    {
      "dfPct": 18,
      "label": "Under 1k/month",
      "servers": 11138,
      "avgScore": 80
    }
  ]
}